I've been running the master version of osqueryd but I don't know if we have that decorator enabled. I'll double check